Commit Graph

59 Commits

Author SHA1 Message Date
Ben Grande
f60077f1a9
doc: spell check 2024-07-08 11:41:45 +02:00
Ben Grande
8604887c66
feat: unify cacher tag list to a single script 2024-07-06 22:30:36 +02:00
Ben Grande
1425cdaf1c
fix: cache Mullvad packages 2024-07-05 16:31:24 +02:00
Ben Grande
d457302fc3
feat: lint python files 2024-07-05 12:24:24 +02:00
Ben Grande
383c840f2f
doc: lint markdown files
Only way to have a unified markdown syntax is to enforce the wanted
syntax by linting the files. Don't rely on the many markdown syntaxes,
be consistent.
2024-07-04 17:27:31 +02:00
Ben Grande
d31699952c
doc: add browser isolation feature to design guide 2024-06-25 23:17:22 +02:00
Ben Grande
9c280689d8
refactor: prefer systemd sockets over socat
- Document preferred method for socket use depending on use case;
- Fix Github web-flow key;
- Standardize naming of services;
- Use sys-ssh in ansible formula;
- Start services conditionally with Qubes Service and evaluated by
  systemd ConditionPathExists= instead of installing on a per qube basis
  with rc.local scripts;
- Change Qusal services to "qusal-" prefix instead of "qubes-" prefix.

Fixes: https://github.com/ben-grande/qusal/issues/80
Fixes: https://github.com/ben-grande/qusal/issues/79
2024-06-25 22:16:26 +02:00
Ben Grande
ab1438f4b5
fix: change Launchpad repository to HTTPS domain
Fixes: https://github.com/ben-grande/qusal/issues/72
2024-06-24 14:32:34 +02:00
Ben Grande
a6194e0364
fix: remove cacher tag from Kicksecure template
Running apt-cacher-ng-repo is during update is unnecessary, the
install-repo macro already does it and the systemd service is run on
boot before Qrexec Agent starts.

Fixes: https://github.com/ben-grande/qusal/issues/66
2024-06-22 12:14:36 +02:00
Ben Grande
c84dfea48e
fix: generate RPM Specs for Qubes Builder V2
It doesn't checkout the current directory when querying the spec, so we
provide the already modified version of the spec.
2024-06-21 17:00:06 +02:00
Ben Grande
59e8fc32a0
fix: GUI Global Config precedes packaged policies 2024-06-17 11:36:39 +02:00
Ben Grande
75d992b041
fix: use Admin API for fast queries 2024-06-13 13:29:30 +02:00
Ben Grande
13c57939a7
fix: uninstall cacher client with tag in pillar
Targeting only qubes with the tag on the installation instructions is
still useful as it is faster than targeting all qubes.

Fixes: https://github.com/ben-grande/qusal/issues/41
2024-06-13 13:28:24 +02:00
Ben Grande
c456af2718
fix: remove duplicated Fedora mirrors 2024-06-10 19:15:14 +02:00
Ben Grande
8ae815de71
fix: run repo rewriter after upstream proxy update
Rewriter depends on the check of qubes-services and must be run after
/usr/lib/qubes/init/misc-post.sh.
2024-06-10 19:02:07 +02:00
Ben Grande
b4de619197
fix: update Debian and Fedora mirrors 2024-06-10 13:57:18 +02:00
Ben Grande
2b181f854a
fix: merge Qubes OS repositories
Only deb and rpm where cached and only if used from the Qubes website
and made to individual directories. Now every package from every package
manager Qubes supports will be cached.

Update according to upstream.
2024-06-10 13:56:59 +02:00
Ben Grande
d2771d5dd6
fix: guarantee states order dependent on browser 2024-06-09 12:50:53 +02:00
Ben Grande
bb384403ad
feat: revive caching of Fedora qubes
- Update with cacher upstream changes;
- Fix README command typos;
- Restore Fedora functionality;
- Update mirror list;
- Move repository definitions to separate files for readability; and
- Add Tailscale and Blackarch repository.
2024-06-07 15:01:16 +02:00
Ben Grande
bb4dcbbe8f
fix: cacher: restrict install to supported clients
- Enforce uninstall in Fedora, it has been too problematic due to zchunk
  checksum mismatch errors;
- Skip tagging and installing on unsupported qubes, before it tagged
  every template that did not have the tag 'whonix-updatevm', this is
  error prone as it would fail the installation on unsupported clients
  such as Gentoo, Mirage.

Fixes: https://github.com/ben-grande/qusal/issues/54
2024-05-29 18:29:27 +02:00
Ben Grande
9cb7d72044
fix: cacher: use systemd service drop-in directory 2024-05-29 13:56:46 +02:00
Ben Grande
a2e1972389
fix: cache Mozilla and Element repository 2024-05-29 09:55:38 +02:00
Ben Grande
b2c9479e50
fix: enforce https on repository installation
Previously was just http to allow for caching and non-caching of
packages. Currently, a client tool exists to rewrite repository
definitions.
2024-05-16 18:57:59 +02:00
Ben Grande
e84959bebb
fix: update fedora mirror list with upstream
Experiment with setting zchunk to false in DNF for Fedora.

Fixes: https://github.com/ben-grande/qusal/issues/47
2024-04-30 14:53:21 +02:00
Ben Grande
760fdd9625
doc: cacher documentation duplicates sections
Fixes: https://github.com/ben-grande/qusal/issues/31
2024-04-30 14:07:03 +02:00
Ben Grande
bfd7b228c5
fix: incorrect path to repo rewriter service
Fixes: https://github.com/ben-grande/qusal/issues/31
2024-04-29 23:10:08 +02:00
Ben Grande
234afc3df8
doc: update cacher table of contents 2024-04-26 19:27:52 +02:00
Ben Grande
1ede2e1a1e
fix: allow update check to work on cacher clients
Qubes that have the updates-proxy-service enabled will have the
repository definitions set to work with the proxy, being it a TemplateVM
or another type of qube. Qubes that have that same service disabled and
are based on templates that are being cached, will have the repository
definitions corrected for it to work like normal systems via the
networking instead of caching proxy.

Optimizations were done for a faster runtime, previously it would call
sed 38 times on Fedora-39, now it only calls sed 2 times for Fedora
repositories (one extra for rpmfusion) and some more for PackageKit and
dnf.conf markers. Inexpensive runtime is a must for a script that may
run multiple times, such as when being called by a tool monitoring the
filesystem such as inotify.

Code from /usr/lib/qubes/update-proxy-configs was used for the NetVM use
case of the cacher, thus the license had to be changed.

For: https://github.com/ben-grande/qusal/issues/44
Fixes: https://github.com/ben-grande/qusal/issues/31
2024-04-26 19:23:14 +02:00
Ben Grande
a6f7d23819
doc: wrong cacher header position 2024-04-25 11:53:47 +02:00
Ben Grande
648bdad04b
fix: remove updatevm tag after DomU uninstallation
For: https://github.com/ben-grande/qusal/issues/41
2024-04-25 11:25:42 +02:00
Ben Grande
63e93be1d4
fix: GUI policy precedes sys-cacher policy
Fixes: https://github.com/ben-grande/qusal/issues/45
2024-04-13 16:17:49 +02:00
Ben Grande
084d08f7c5
doc: uninstall cacher client based on tag
For: https://github.com/ben-grande/qusal/issues/41
2024-03-25 12:34:59 +01:00
Ben Grande
4ac0ec9613
fix: cacher jinja fails to split words
Fixes: https://github.com/ben-grande/qusal/issues/35
2024-03-21 21:52:02 +01:00
Ben Grande
7faf944964
feat: apply URI changes in qube
Very useful for template based qubes to uninstall the cacher definition
to reach remote repository definitions with direct connection.

https://github.com/ben-grande/qusal/issues/31
2024-03-21 21:50:02 +01:00
Ben Grande
9e96d80b52
fix: add missing archlinux mirror 2024-03-21 16:30:36 +01:00
Ben Grande
f9ead06408 fix: remove extraneous package repository updates
Updates happens multiple times, normally 2 to 3, even if we consider a
state without includes. On states with multiple includes, it could
easily get approximately 10 updates being ran. This behavior leads to
unnecessary network bandwidth being spent and more time to run the
installation state. When the connection is slow and not using the
cacher, such as torified connections on Whonix, the installation can
occurs much faster.

Adding external repositories has to be done prior to update to ensure it
is also fetched.

Fixes: https://github.com/ben-grande/qusal/issues/29
2024-03-18 17:51:36 +01:00
Ben Grande
5605ec7885 doc: prefix qubesctl with sudo
Fixes: https://github.com/ben-grande/qusal/issues/20
2024-02-23 16:55:11 +01:00
Ben Grande
0cd3e662da fix: remove hardcoded fedora versions from cacher 2024-02-22 21:58:14 +01:00
Ben Grande
908a0773db fix: allow apt-cacher-ng cronjob to run 2024-02-22 21:57:51 +01:00
Ben Grande
23dbc723cb fix: update apt-cacher-ng mirror list 2024-02-22 21:57:26 +01:00
Ben Grande
89bd760d3c feat: add OpenTofu 2024-02-19 23:36:54 +01:00
Ben Grande
b5d7371f93 fix: thunar requires xfce helpers to find terminal 2024-01-31 14:42:17 +01:00
Ben Grande
6efcc1da77 chore: copyright update 2024-01-29 16:49:54 +01:00
Ben Grande
422b01e0f6 feat: remove audiovm setting when unnecessary
Decrease audio attack surface to qubes that will never need to use it.
2024-01-20 19:34:39 +01:00
Ben Grande
0887c24a19 fix: remove unicode from used files
No considering license, copyright notices kept outside of the installed
directories, but excluding keys that have unicode in their comment
section.
2024-01-18 15:23:52 +01:00
Ben Grande
8d7c0a2d0b fix: sys-cacher policy with the new tag name 2024-01-12 18:34:04 +01:00
Ben Grande
233ac76bcb fix: sys-cacher tag compliance with default tags
The default tags start with the capability than the qube name, such as
audiovm-dom0 and guivm-dom0.
2024-01-12 17:30:29 +01:00
Ben Grande
a97e3c0c8a feat: kicksecure minimal template 2024-01-12 17:24:31 +01:00
Ben Grande
2b6daac8a9 fix: shellcheck 2024-01-10 14:31:57 +01:00
Ben Grande
38d98ecb0d fix: nft shebang and table names 2023-12-20 16:49:58 +01:00